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Abstract. We present CRISNER (Conditional & Relative Importance 
Statement Network PrEference Reasoner), a tool that provides practi¬ 
cally efficient as well as exact reasoning about qualitative preferences 
in popular ceteris paribus preference languages such as CP-nets, TCP- 
nets, CP-theories, etc. The tool uses a model checking engine to translate 
preference specifications and queries into appropriate Kripke models and 
verifiable properties over them respectively. The distinguishing features 
of the tool are: (1) exact and provably correct query answering for test¬ 
ing dominance, consistency with respect to a preference specification, 
and testing equivalence and subsumption of two sets of preferences; (2) 
automatic generation of proofs evidencing the correctness of answer pro¬ 
duced by CRISNER to any of the above queries; (3) XML inputs and 
outputs that make it portable and pluggable into other applications. We 
also describe the extensible architecture of CRISNER, which can be ex¬ 
tended to new preference formalisms based on ceteris paribus semantics 
that may be developed in the future. 
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1 Introduction 

Several qualitative preference reasoning languages have been developed in the 
last two decades, such as CP-nets, TCP-nets, CP-Theories, etc. Despite their rel¬ 
atively high expressive power (compared to quantitative preference formalisms), 
their widespread application and use in practice is limited, at least in part due 
to their hardness. The basic reasoning tasks such as dominance and consistency 
testing are known to be PSPACE-complete for a simple language such as the 
CP-net. Another reasoning task, checking whether the equivalence or subsump¬ 
tion of the preferences induced by one agent with respect to those induced by 
another, is important in multi-agent scenarios and negotiation but also known 
to be hard m- Past works to cope with this hardness include restricting the 
expressivity of the languages to obtain tractable fragments, and heuristics that 
yield results in acceptable time but not guaranteed to be exactly correct. Nev¬ 
ertheless, there are applications such as negotiation, planning, security policies, 
etc. that call for exact reasoning about qualitative preferences with guarantees 
of correctness (e.g., choosing the best policy to defend a computer network). 
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In this paper, we present CRISNER (Conditional & Relative Importance 
Statement Network PrEference Reasoner) [14], a tool that provides practically 
efficient as well as exact reasoning about qualitative preferences in popular ceteris 
paribu^ [TU] preference languages such as CP-nets, TCP-nets and CP-theories. 
For a preference specification P consisting of a set {pi,P 2 , ■ ■ - Pn} of qualitative 
preference statements in any of the above CP-language^ the ceteris paribus 
semantics for dominance, consistency etc. are given in terms of reachability over 
an induced preference graph wherein each node corresponds to an outcome and 
each edge from one node to another represents a preference from the latter node 
to the former node induced by some statement pi in P. CRISNER uses a model 
checking |S] engine NuSMV to translate preference specifications and queries 
into appropriate Kripke structure models m and reachability properties over 
them respectively. 

Encoding Preferences as Kripke models. Given a specification P, CRISNER 
first succinctly encodes the induced preference graph (IPG) of P into a Kripke 
structure model Kp in the language of the NuSMV model checker. Although 
Kripke structures are typically used to represent semantics of temporal and 
modal logics, we leverage earlier work mm that demonstrated their use for 
encoding preference semantics. For testing dominance and consistency with re¬ 
spect to each P, CRISNER generates the model Kp only once. Subsequently for 
each preference query q posed against P, CRISNER translates q into a tempo¬ 
ral logic formula pq in computation-tree temporal logic (CTL) |18I7] such that 
Kp \= Pq if and only if q holds true according to the ceteris paribus semantics of 
P. CRISNER then queries the model checker with the model Kp and Pq which 
either affirms q or returns false with a counterexample. For answering queries 
related to equivalence and subsumption checking of two sets of preferences Pi 
and P 2 , CRISNER constructs a combined IPG Kp^^ and uses temporal queries 
in CTL to identify whether every dominance that holds in Pi also holds in P 2 
and vice-versa m- 

Justification of Query Answers. The answers to queries computed by CRISNER 
are exact and provably correct for dominance, consistency, equivalence and 
subsumption queries. Because CRISNER uses the model checker for answer¬ 
ing queries, CRISNER is also able to provide proofs or justifications to queries 
that returned false. CRISNER automatically builds proofs evidencing why the 
query did not hold true, by collecting and examining the model checker’s coun¬ 
terexample and producing a sequence of preference statements whose application 
proves the correctness of CRISNER’s result. 

Tool Architecture. CRISNER is developed in pure Java and is domain agnos¬ 
tic in the sense that any set of variables with any domain can be included in a 
preference specification, although it is optimized for variables with binary do¬ 
mains. It accepts preference specifications and queries in a XML format, which 
provides a common and generic syntax using which users can specify preferences 

^ Ceteris paribus is a Latin term for “all else being equal”. 

^ Henceforth, we will refer to the languages CP-nets, TCP-nets and CP-theories col¬ 
lectively as ‘CP-languages’ for brevity. 
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for CP-languages. The results (answers and proofs) for the corresponding queries 
are also saved in the form XML, so that the results can be further transformed 
into vocabulary that is more easily understandable by domain users. We de¬ 
scribe the architecture of CRISNER and how it can be extended to other ceteris 
paribus preference formalisms that may be developed in the future. 

CRISNER has been in development for over two years, and to our knowl¬ 
edge, CRISNER is one of the first attempts to develop practical tools for hard 
qualitative preference reasoning problems. We hope that CRISNER inspires the 
use of qualitative preference formalisms in practical real world applications, and 
the development of further qualitative preference languages. 

2 Background: Syntax and Semantics of CP-languages 

Let X = {xi I 0 < f < n} be a set of preference variables or attributes. For each 
Xi £ X let Di be the set of possible values (i.e., domain) such that Xi = Vi G Di 
is a valid assignment to the variable Xi- We use 17 (indexed, subscripted or 
superscripted as necessary) to denote subsets of X. The set O = {a \ Ila; gx 
of assignments to variables in X is the set of alternatives. The valuation of an 
alternative a G O with respect to a variable S X is denoted by a{xi) G Di. 
2.1 Preference Relations, Statements & Specifications 
Given a set O oi n alternatives, a direct specification of a binary preference rela¬ 
tion over O is difficult, as it requires the user to compare up to 0{n^) pairs of 
alternatives, which is prohibitive in time. Hence, many preference languages al¬ 
low for succinct specification of the preference relation over alternatives in terms 
of preference relations over the set of attributes that describe the alternatives and 
their respective valuations or domains. 

Preference Relations Qualitative preference relations can be either (a) intra¬ 
variable preference relations over valuations of an attribute; or (b) relative im¬ 
portance preference relations over attributes. For any C X, we will use the 
notation to denote a preference relation over D,p, the set of partial assign¬ 
ments to attributes in d>. For a single attribute Xi G X, the intra-attribute pref¬ 
erence relation over its valuations (Di) will be denoted by or alternatively 

>-i . For example, to formally specify that the valuation Vi is preferred to the 
valuation u' for attribute Xi where € Di, we will write Xi = Vi >i Xi = u'. 
We will use the notation > to indicate relative importance between attributes 
or between sets of attributes. 

Preference Specifications & Statements In the CP-languages, preferences are 
expressed in terms of a preference specification, which is a set P = {pi} of 
preference statements. Each statement p may specify a binary relation over the 
set X of preference variables (relative importance) and/or a binary relation over 
the domain of a particular variable (intra-variable preference). The syntax of the 
preference statements is given below. 

CP-nets [219] allow the specification of only conditional intra-variable pref¬ 
erence^ TCP-nets [S] allow the users to specify pairwise relative importance 

We use the term CP-nets to refer to the more general formalism defined by Goldsmith 
et al. [9]. 
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(a) CP-net Pi 



(b) CP-net Pa 



(c) TCP-net P 3 


Fig. 1. Consistent and inconsistent CP-nets; TCP-net 

among variables in addition to conditional intra-variable preferences as in CP- 
nets. CP-Theories m extend TCP-nets by further allowing the specification of 
the relative importance of one variable over a set of variables conditioned on an¬ 
other set of variables. As CP-theories strictly generalize CP-nets and TCP-nets 
[19], we give the syntax for CP-theories here. A CP-Theory consists of statements 
of the form 

Q ■. Xi= Vi>i Xi= v[ [C] 

where q is an assignment to the set C X of variables that defines the condition 
under which the preference holds, Vi, v[ G Di, CCA, and C, {a;^} and (A — 
— C — {xi\) are disjoint. The statement expresses the relative importance of 
the variable Xi over the set Q of variables under the condition g. Note that 
CP-nets can be expressed as CP-Theories by fixing C = 0 (i.e., |C| = 0); and 
TCP-nets can be expressed as CP-Theories by fixing |C| = 0 or 1. Hence we use 
the above genera syntactic form to refer to a preference statement in any of the 
CP-languages. Figure[^shows two CP-nets Pi and P 2 , and a TCP-net P 3 where 
the red dotted arrow from A to B indicates that A is more important than B. 

2.2 Ceteris Paribus Semantics 

The ceteris paribus semantics of the CP-languages define an induced preference 
graph with nodes corresponding to the outcomes, and the edges induced by 
the language-specific interpretation of preference statements. According to the 
ceteris paribus interpretation nnEi, each preference statement p G P allows a 
set of changes to the valuation(s) of one or more variables in an alternative /3 
in order to obtain a more preferred alternative a, while other variables remain 
hxed. Such a change is called an improving flip. The improving flips induced 
by the different types of preference statements is summarized below; we do not 
elaborate on the semantics of each CP-language, and refer the interested reader 
to mm for details of the semantics of the respective languages. 

Consider an intra-variable preference statement p of the form g : Vi >-{xi} 
which can be specified in all the languages we consider. Given two alternatives 
a, 13 G O, the ceteris paribus interpretation of the statement p induces an im¬ 
proving flip {13, a) G A in 5{P) if a and (3 differ only in Xi, and a{xi) = Vi and 
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P{xi) = f'. In other words for any statement p, the valuation of only one variable 
can be flipped at a time, and that to a more preferred valuation with respect to 
p, while other variables remain fixed. 

Definition 1 (Preference Semantics for Intra-attribute Preference [2]I. 

Given an intra-attribute preference statement p in a preference specification P 
of the form g : Xi = Vi Xi = where g € D^,<P = p{xi) C X and two 

alternatives a,/3 G O, there is an improving flip from f to a in S{P) induced by 
p if and only if 

1. 3xi G X : a(xi) = Vi and f{xi) = v[, 

2. 'ixj G : a{xj) = l3{xj) = g{xj), and 

3. Vxfc e X \ {xi} \ ^ : a{xk) = I3{xk). 

In the above definition, the first condition arises from the intra-attribute 
preference statement xp, the second condition enforces the condition g in p that 
states that a and /? should concur on the parent variables of xp, and the third 
enforces the ceteris paribus condition that states that a and j3 should concur on 
all the other variables. 

TCP-nets and CP-Theories allow the specification of relative importance 
preference of one variable over one or more variable respectively. Hence, multiple 
variables can change in the same improving flip because a statement of relative 
importance of one attribute over others means that the user is willing to improve 
the valuation of the more important attribute at the expense of worsening the 
less important attribute(s). 

Definition 2 (Preference Semantics for Relative Importance of one 
Attribute over a Set mm]). Given a relative importance preference state¬ 
ment p in a preference specification P of the form g : Xi = Vi Xi = v[ [fi] 

where g G D^,<P C X and two alternatives a,/3GO, there is an improving flip 
from fi to a in 5{P) induced by p if and only if 

1. 3xi € X : a(xi) = Vi and fi{xi) = v[, 

2. 'ixj G : a{xj) = fiixj) = g{xj), and 

3. \/xk G X \ {xi} \n\<P : a{xk) = /3(xfc). 

In the above definition, the first condition arises from the preference state¬ 
ment p on Xi; the second condition enforces the condition g in p; and the third 
enforces the ceteris paribus condition and allows for unrestricted changes to the 
attributes that are less important than Xi (in 17) when this preference statement 
is applied. 

The above interpretations define valid improving flips induced by statements 
in P that correspond to edges in the induced preference graph denoted 
IPG{P), whose nodes are the set of all outcomes or alternatives (i.e., the set of 
all assignments to all preference variables), and which represents the dominance 
relation 'i^p over the outcomes. Figure shows the induced preferences graphs 
for the respective CP-nets and TCP-net in Figurej^ Note that the red solid edges 
in IPGlyPf) are those induced by the dependency of C on A in P 2 . Similarly, 
the red dotted edges in IPG{P-i) are those induced by the relative importance 
of A over B in P 3 . 
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Fig. 2. Induced preference graphs of CP-nets and TCP-net 

3 Preference Queries 

Computing answers to preference queries with respect to a given preference spec¬ 
ification in the ceteris paribus semantics amounts to making querying properties 
related to reachability on the induced preference graph. We consider the follow¬ 
ing preference queries that have been implemented in CRISNER in this paper. 

Definition 3 (Dominance &: Consistency Testing |2l9lll9j b Given a pref¬ 
erence specification P consisting of a set of preference statements {pi,P 2 ■ ■ -Pn}, 
and two outcomes a, P G O 

1. Dominance Testing (a'^p P) asks whether there a sequence of improving 
flips from P to a in IPG{P) ? 

2. Consistency Testing asks whether the preferences induced by P are con¬ 
sistent, i.e., is there is a cycle in IPG{P)? 

Definition 4 (Preference Equivalence & Subsumption |17| b Given two 
preference specifications Pi,P 2 and two outcomes a,P €0, 

1. Preference Subsumption (Pi G P 2 ) asks whether a>p^ P ^ a>-p^ p. 

2. Preference Equivalence (Pi = P 2 ) asks whether Pi C P 2 and P 2 E Pi- 


3.1 Preference Query Answering via Model Checking 

In order to address the PSPACE-hardness of the problems of dominance and 
consistency, CRISNER implements the model checking based approach to pref¬ 
erence query reasoning as presented in the series of works by Santhanam et al. 
|15 | 16 | 17| . There are two direct benefits of using the model checking approach to 
answering preference queries. First, by using the model encoding techniques pre¬ 
sented in the above works, then dominance and consistency queries can be trans¬ 
formed into equivalent reachability queries on the Kripke model in a straightfor¬ 
ward way. The transformation from the preference specification and query to the 
Kripke model and temporal logic formula respectively is at a syntactic level prior 
to execution of the model checker (without having to build the induced prefer¬ 
ence graph); thus preserving the benefits of succinctness of the CP-languages. 
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When the query is actually executed on the model checker, the induced pref¬ 
erence graph is expanded to the extent needed by the model checker to verify 
the temporal logic formula. This would enable us to leverage the decades of ad¬ 
vances in model checking algorithms and tools. The second direct benefit if the 
model checker returns a counter example to the encoded temporal logic formula 
(corresponding to the original preference query), which is in terms of states and 
transition sequences in the Kripke model, then it can be conveniently mapped 
back to nodes and paths in the induced preference graph. This allows CRISNER 
to automatically generate justifications for dominance and consistency queries 
by producing sequences of improving flips in the induced preference graph that 
either prove the dominance or disprove the consistency. 

CTL model checking We use formulas in computation-tree temporal logic (CTL) 
[S] for verifying reachability within the Kripke model generated by CRISNER. 
Our choice of model checker is NuSMV [5], an open source and widely used tool. 
CTL is an extension of propositional logic; CTL uses propositional and temporal 
connectives to express temporal properties, whose semantics is given in terms 
of a set of states in the Kripke structure where the properties are satisfied. We 
briefly outline the syntax and semantics of some CTL connectives below, and 
refer the reader to [5] for details. The syntax of CTL is described as follows: 

if —>■ true I Atomic-Propositions | \ pM p \ EI^p \ EGp \ E{p U p) 

The semantics of a CTL formula p is given in terms of the set of states in a 
Kripke structure that satisfy p. The propositional constant true is satisfied in 
all states; the proposition p holds in states labeled with p. The negation of p 
is satisfied if the formula does not hold. The disjunct of two CTL formulas is 
satisfied by states if at least one of the disjuncts is satisfied. The rest of the 
operators in the CTL syntax are temporal operators that quantify the states 
and the transitions. The property EX(^ is satisfied in any state s which can reach 
some (E, for existential quantification) state t in one transition (X, for one step 
reachability) such that t satisfies p. The property EGt/j is satisfied in any state s 
which has some (E) path where every (G) state ti’s in the path satisfy p. Einally, 
the property E{pi U P2) is satisfied in any state s which has some (E) path where 
there exists a state t which satisfied p 2 and in all states before t, pi is satisfied. 
Semantics for other CTL formulas are described in terms of the above, e.g., EFi^ 
is satisfied in any state from where there exists a path eventually leading to a 
state that satisfies p. This is equivalent to E{true U p). There are other temporal 
connectives which we mention and explain as needed in terms of the above in 
this paper. 

3.2 Encoding Preference Queries in CTL 

Here we outline the overall strategy to obtain answers to preference queries in the 
languages CP-languages. We assume that CRISNER is given a preference speci¬ 
fication P and a preference query q that is a test for either a dominance, consis¬ 
tency, preference subsumption or preference equivalence. The task of CRISNER 
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is then to compute whether q holds (or not) with respect to the ceteris paribus 
semantics of P. 

Dominance Testing Testing dominance of an outcome over another amounts to 
simply checking reachability from one outcome to another in IPG{P). To answer 
the dominance query a j3, CRISNER constructs a temporal logic formula 
that corresponds to reachability from /3 to a in IPG{P) and executes the query 
on the NuSMV [5] model checker, affirming dominance if and only if the model 
checker returns true. Defining AP to be the set of preference variables in P and 
ipa to be the formula encoding the set of variables assigned true in the outcome 
a, the above dominance can be encoded in the following CTL formula: 

ip IS =P EF(^q, 

Consistency Testing Consistency testing amounts to checking that there are no 
cycles in IPG{P). To test consistency for P, CRISNER verifies the following 
CTL formula, which states that for all start states (If no start states are ini¬ 
tialized, NuSMV non-deterministically considers all states in the Kripke model 
as start states ), there must be no reachable node from which there is a path 
back to a, i.e. there is no cycle in IPG{P). 

start ^ ^EX (g = I A EF start) 

In the above, g = 1 holds whenever the destination state of a current state results 
from an improving flip as per the underlying preference semantics. 

Preference Subsumption and Equivalence Preference equivalence (subsumption) 
checking m amounts to testing whether the preferences induced by two pref¬ 
erence specifications Pi and P 2 are the same (or such that one subsumes the 
other) or not. Given Pi and P 2 , CRISNER constructs an SMV model Kp-^^ of 
the combined induced preference graph (CIPG) |17j that encodes the union of 
preferences induced by Pi’s preference statements and the reverse of those in¬ 
duced by P 2 ’s preference statements. In order to answer whether Pi subsumes 
the preferences induced by P 2 or not, CRISNER constructs the following tem¬ 
poral logic formula that is verified by NuSMV if and only if Pi subsumes P 2 
(we use gi and g 2 to refer to the g for the models corresponding to Pi and P 2 
respectively. 

ip : AX { gi ^ EX E [32 U (start A 32 ) ] ) 

The above states that whenever there is an improving flip in IPG{Pi) from a to 
an outcome (AX 31 ..), then there exists a sequence of improving flips (EXP( 32 U...)) 
from that outcome in IPG{P 2 ) back to a. In the above, all possible a is captured 
by the proposition start. Preference equivalence is checked by in turn verifying 
that Pi C P 2 and P 2 C Pi. 


4 XML Input Language 

CRISNER accepts a preference specification for any of the CP-languages in 
an XML format. The preference specification consists of a declaration of the 
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preference variables, their domains and a set of preference statements. Each 
preference statement is of the form discussed in Section \2.1\ and expresses an 
intra-variable and/or relative importance preference relation over the domain of 
a variable. 


4.1 Defining Preference Variables 

Figure shows part of a preference specification defining variables and their 
domains. The preference variable a has a binary domain with values 0 and 1, 
whereas x has a domain {0,1,2}. Note that CRISNER supports domain valua¬ 
tions with string values that are combinations of letters and numbers, as allowed 
by NuSMV. 


<VARIABLE> 

<NAME>a</NAME> 

<D0MAIN-VALUE>0</D0MAIN-VALUE> 

<D0MAIN-VALUE>1</D0MAIN-VALUE> 

</VARIABLE> 

(a) 


<VARIABLE> 

<NAME>x</NAME> 

<D0MAIN-VALUE>0</D0MAIN-VALUE> 
<DOMAIN-VALUE> 1 </DOMAIN-VALUE> 
<D0MAIN-VALUE>2</D0MAIN-VALUE> 
</VARIABLE> 

(b) 


Fig. 3. XML encoding of definitions of preference variable a with domain size 2 and 3 


4.2 Specifying Conditional Preference Statements 

The listing in Figure]^ shows a portion of a preference specification that declares 
preferences over values of the variable c conditioned on the variables b and a 
respectively. The VARIABLE tag identifies the variable whose preferences are being 
specified. Note that there can be multiple conditions or no conditions as well. 
In addition, there can also be multiple preferences for a variable, e.g., if there 
is a variable with domain of 0,1, 2 then to specify the total order 0 1 2 

one would encode 0 1 as one preference followed by 1 2. CRISNER requires 

that the variable names and their assignments match with the preference variable 
declarations in the file; otherwise the tool reports an appropriate error stating 
that the variable is not defined in the preference specification. 

4.3 Specifying Relative Importance Preferences 

In order to allow specification of relative importance of one variable over another, 
as in a TCP-net, CRISNER allows the tag REGARDLESS-OF within a preference 
statement. Figure [^a) declares a preference statement that says (in addition 
to the fact that a = 0 a = 1) that a is relatively more important than b. 
In order to specify relative importance of one variable over a set of other vari¬ 
ables (simultaneously) as allowed by a CP-theory, the user can specify multiple 
REGARDLESS-OF tags within the same preference statement. For instance. Fig¬ 
ure [^b) shows a preference statement that declares that a is relatively more 
important than {b,c}. 


5 Encoding Preferences as SMV Models 

CRISNER encodes Kripke models for a preference specification as described ear¬ 
lier. Now we discuss constructs in NuSMV used by CRISNER for the encoding. 
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<PREFERENCE-STATEMENT> 

<STATEMENT-ID>p3</STATEMENT-ID> 
<VARIABLE>c</VARIABLE> 
<C0NDITIGN>b=0</C0NDITI0N> 
<PREFERENCE>0 : 1</PREFERENCE> 
</PREFERENCE-STATEMENT> 

(a) 

Fig. 4. XML encoding of conditional 

<PREFERENCE-STATEMENT> 

<STATEMENT-ID>pl</STATEMENT-ID> 
<VARIABLE>a</VARIABLE> 
<PREFERENCE>0 : 1</PREFERENCE> 
<REGARDLESS-OF>b</REGARDLESS-OF> 
</PREFERENCE-STATEMENT> 

(a) 


<PREFERENCE-STATEMENT> 

<STATEMENT-ID>p4</STATEMENT-ID> 
<VARIABLE>c</VARIABLE> 
<C0NDITI0N>a=0</C0NDITI0N> 
<PREFERENCE>1 : 0</PREFERENCE> 
</PREFERENCE-STATEMENT> 

(b) 

ice statements pa and P 4 in a CP-net 

<PREFERENCE-STATEMENT> 

<STATEMENT- ID>p 1< /STATEMENT-ID> 
<VARIABLE>a</VARIABLE> 
<PREFERENCE>0 : 1</PREFERENCE> 
<REGARDLESS-OF>b</REGARDLESS-OF> 
<REGARDLESS-OF>c</REGARDLESS-OF> 
</PREFERENCE-STATEMENT> 

(b) 


Fig. 5. XML encoding of conditional preference statements pa and p 4 in a CP-net 


5.1 Encoding Preference Variables & Auxiliary Variables 

In order to encode the CP-net Pi in our earlier example, CRISNER generates the 
code for the SMV model as shown in Figure We explain the translation of a 
preference specihcation into an SMV model by CRISNER through this example. 

CRISNER defines just the main module, with 3 variables corresponding to the 
preference variables in Pi and another variable g, which we will explain shortly. 
We overload a,b,c to refer to variables in the Kripke model and variables in 
the preference specihcation, hence valuations of a, 5, c in a state s in the Kripke 
model respectively correspond to the valuations of the preference variables a, b, c 
in the preference specihcation P. The variables a, b, c are state variables in the 
SMV model i.e., their valuations stored by the model checker for each state 
explored during model checking. 

The IVAR variables cha,chb,chc are modeled as input variables, i.e., their 
valuations are not stored as part of each state. The model checker initializes them 
non-deterministically for each state so that all paths are open for exploration by 
the model checker during verihcation. Each preference statement is translated 
into an appropriate guard condition for a transition in the Kripke model, and 
the semantics of variables cha, chb, chc either allows or disallows the change in 
the value of the corresponding preference variable a, b, c, in accordance with the 
improving flip semantics. 

Identifying transitions corresponding to improving flips. The additional 
g variable is defined to be true exactly when the model checker transitions from a 
state corresponding to one outcome to a state corresponding to another outcome 
(not transitions between states corresponding to the same outcome). Hence, we 
can conveniently refer to transitions in the Kripke models that correspond to 
improving flips by constraining g to have valuation 1 in the destination state. 
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Referencing start states explored by NuSMV. The FROZEN variables 
a_ 0 , b_ 0 , c _0 are constrained to be fixed with the values of the variables a, b, c 
respectively at the start of the model checking algorithm via the DEFINE and 
INIT constructs. This allows us to refer to the state non-deterministically picked 
by the model checker as the start of model exploration using start. This is used 
for computing consistency, preference subsumption and preference equivalence. 


MODULE main 

ASSIGN 

VAR 

next (a) := case 

a : {0,1}; 

a=l & cha=l & chb=0 & chc=0 : 0; 

c : {0,1}; 

TRUE : a; 

b : {0,1}; 

esac ; 

g : {0,1}; 

next(c) := case 

FROZENVAR 

c=l & b=0 & cha=0 & chb=0 & chc=l : 0; 

a_0 : {0,1} 


TRUE : c; 

b_0 : {0,1} 


esac ; 

c_0 : {0,1} 


next(b) := case 

IVAR 

b=0 & c=0 & cha=0 & chb=l & chc=0 : 1; 

cha : {0,1} 


TRUE : b; 

chb : {0,1} 


esac ; 

chc : {0,1} 


next(g) := case 

DEFINE 

a=l & cha=l & chb=0 & chc=0 : 1; 

start := a=a_0 

c=l & b=0 & cha=0 & chb=0 & chc=l : 1; 

& b=b_0 & 

n 

II 

0 

1 

0 

b=0 & c=0 & cha=0 & chb=l & chc=0 : 1; 


TRUE: 0; 

INIT start=TRUE; 

esac ; 


Fig. 6. SMV code for Kripke Model encoding IPG{P\) 


5.2 Encoding Preference Statements 

Encoding Intra-variable Preferences. To encode a intra-variable preference 
statement for a variable x with a condition p on the other variables, the next (x) 
construct encodes guards such that the valuations of the other variables corre¬ 
spond to those in the condition p, and valuation of chx is 1 while all other ch 
variables are set to 0. As an example, next (a) includes a transition such that c 
changes from 1 to 0 precisely when 6 = 0 and chc = 1 {cha = 0 , chb = 0 , allow¬ 
ing only c to change in that transition), which corresponds to the improving flip 
induced by pa conditioned on the value of a in the CP-net Pi (Figure]^. 
Encoding Relative Importance. For modeling relative importance prefer¬ 
ence statements, multiple IVAR variables can be assigned 1 in guard conditions 
such that the more important and less important preference variables can change 
in the same transition - corresponding to an improving flip for relative impor¬ 
tance. For example. Figure shows a snippet of the SMV code that models the 
transitions arising from the relative importance of a over 6 as in the TCP-net P 3 
shown in Figure [^c). Note that cha and chb are set to 1 for the second guard 
condition of next (b) , allowing a to change to a preferred value trading off 6 . In 
order to model relative importance as in a CP-theory where one variable is more 
important than multiple others, a similar encoding is used, except that all the 
corresponding ch variables are set to 1. 
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next(b) := case 




b=0 & c=0 & 

cha=0 & 

chb=l & 

chc=0 : 1; 

a=l & cha=l 

TRUE : b; 

esac ; 

& chb=l 

& chc=0 



Fig. 7. Encoding relative importance preferences for the TCP-net P 3 


5.3 Justification of Query Results 

In addition to answering preference queries posed against preference specifica¬ 
tions, CRISNER also provides a justification of the result where appropriate. In 
order to obtain justification, CRISNER uses the counterexamples returned by 
NuSMV model checker whenever a temporal logic formula is not satisfied. 

Extracting a Proof of Dominance. In the case of a dominance query, if 
CRISNER returns true, we construct another temporal logic formula that states 
the negation of the dominance relationship, which obtains a sequence of outcomes 
corresponding to an improving flipping sequence from the lesser preferred to the 
more preferred outcome from the model checker. Suppose that we want to obtain 
proof that an alternative a dominates another alternative /3. This means that 
—>■ EF(^q, holds. We then verify t EF(/5 q,), which obtains a sequence of 

states in the Kripke model corresponding to an improving flipping sequence from 
j3 io a from the model checker corresponding to an improving flipping sequence 
from j3 to a which serves as the proof of dominance. 


Extracting a Proof of Inconsistency. In the case of a consistency query 
(see Section 3.2), CRISNER returns a sequence of outcomes corresponding to 
an improving flipping sequence from an outcome to itself (indicating a cycle 
in the induced preference graph) whenever the preference specification input is 
inconsistent. 


Extracting a Proof of Non-subsumption. For a preference subsumption 
query Pi C ^ 2 , CRISNER provides an improving flip from one outcome to 
another induced by Pi but not induced by P 2 whenever the query does not hold. 

In the above, counterexamples returned by NuSMV are in terms of states and 
transitions in the Kripke model; CRISNER parses and transforms the counterex¬ 
amples back into a form that relates to the preference variables, outcomes and 
improving flips in the induced preference graph of the preference specification, 
and saves it in an XML format. 

6 Architecture 

CRISNER is built using the Java programming languag^ The architecture of 
CRISNER consists of several components as depicted in Figure 

The XML parser is used to parse the preference specifications and preference 
queries input by the usei[^ The CP-language translator is a critical component 

Third party libraries used by CRISNER are listed in the project site m 
® While currently CRISNER does not use XML schema or DTD to validate the XML 
input, we plan to enforce that in future. 
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Fig. 8. Architecture and components of CRISNER preference reasoner 


that constructs the SMV code for the Kripke model for the preference specifi¬ 
cation input. It declares the necessary variables with their domains, sets up the 
DEFINE, TRANS and INIT constraints and finally generates guard conditions for 
enabling transitions corresponding to improving flips induced by each preference 
statement (as discussed in Section 3.1). 

CRISNER provides two interfaces for preference reasoning. The first is a 
simple command line menu-drive console interface where the user can provide 
either (a) one preference specification as input and then use the menu to pose 
dominance and consistency queries, or (b) two preference specifications as in¬ 
put and pose a subsumption or equivalence query. The answer (true/false) 
obtained and the justification for the answer (where possible) is provided on the 
console. Another way of using CRISNER is to specify preference queries in an 
XML file that contains a dominance or consistency or preference equivalence or 
subsumption query, and identifies the preference specification against which the 
query should be executed. The query translator component parses queries spec¬ 
ified in XML format and provides it to the Reasoner component. Eurther details 
about the XML tags and examples of preference specification, preference queries 
and sample SMV code generated by CRISNER are available from CRISNER’s 
project website http: //www. ece. iastate . eduZ-gsanthcUi/crisner. html, 

The Reasoner is another critical component in CRISNER that constructs a 
temporal logic formula corresponding to the preference query posed by the user, 
and invokes the NuSMV model checker to verify the formula. The result and 
any counter examples generated by the model checker are parsed by the Results 
Translator, and saved in XML format by the XML Encoder. If a counter example 
is applicable to the preference query, then the Justifier parses the XML output 
and executes any followup queries on the model checker (e.g., verification of the 
negation of the dominance query) to provide the user with the appropriate proof. 


Extensibility. Although CRISNER currently supports the CP-net, TCP-net 
and CP-theory formalisms, it can be extended to support another qualitative 
preference language, as long as the semantics of the language is described in 
terms of an induced preference graph. To extend support, the XML parser must 
be extended to support the syntax of the new language; and the CP-language 
translator must be extended to generate SMV code according to the semantics of 
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the new language. We are currently working on including support for the condi¬ 
tional importance network (Cl-net) [4] language for representing and reasoning 
with preferences in the context of fair division of indivisible goods. As another 
example, one can think of a new preference formalism may allow expression of 
preferences of one partial assignment of variables over another. In such a case, 
the CP-translator component can be extended to include a translation for such 
a preference statement into guard conditions in the Kripke model representing 
the induced preference graph. CRISNER can also be extended to support new 
preference queries, for example, computing a weak order or total order exten¬ 
sion of the partial order induced by a preference specification. In this case the 
Query translator and Reasoner should be extended to translate the new queries 
into one or more appropriate temporal logic formulas (as described in |12j l and 
the Justifier should be extended to construct and execute follow up queries that 
obtain proofs for the answers. 

Scalability. While we have not yet performed a systematic experiment study¬ 
ing CRISNER’s runtime performance for preference specifications of different 
sizes (number of preference variables), our preliminary tests have revealed that 
CRISNER answers dominance (including the computation of justihcation for a 
when applicable) in less than a minute on average for upto 30 variables on a 8GB 
Corel? Windows 7 desktop. Although CRISNER allows variables with domain 
size n > 2, the model checking performance degrades quickly with increasing n; 
this can be alleviated by configuring the NuSMV model checker to use multi-way 
decision diagrams [T]. 

7 Concluding Remarks 

We presented CRISNER, a tool for specifying and reasoning with qualitative 
preference languages such as CP-net, TCP-net and CP-theory. CRISNER trans¬ 
lates preference specihcations and queries with respect to them provided in XML 
format into a Kripke structure and corresponding temporal logic (CTL) queries 
in the input language of the NuSMV model checker. Currently CRISNER sup¬ 
ports dominance, consistency, preference equivalence and subsumption testing 
for the above languages. The obtained results from the model checker, includ¬ 
ing proofs of dominance, inconsistency or non-subsumption, are translated by 
CRISNER back in terms of the vocabulary of the input preference specihcation 
and saved in XML format. CRISNER’s architecture supports extension to other 
preference queries and preference languages such as Cl-nets whose semantics are 
in terms of the induced preference graph. 

Work in progress includes adding support for dominance and consistency 
testing with Cl-nets, which is useful in multi-agent fair division problems. In 
the future, we plan to add support for computing weak order and total order 
extensions to consistent and inconsistent preference specifications, which is useful 
in applications like stable stable matching and recommender systems. We also 
plan to add support for reasoning with group preferences, i.e., reasoning about 
the preferences of multiple agents. 
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